It's probably related to the issue published by aikidolabs where leaked per-user gitlab issued emails were being used as a sort of credential.

https://www.aikido.dev/blog/gitlab-email-push-to-main